CVE-2026-110983
CVE-2026-110983 · WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
CVSS 4.3 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
wp photo album plus
- Versions
- ≥ 0, < 9.3.04.004: Affected (semver)
Update to 9.3.04.004